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Abstract 

Quantum walk is one of the main tools for quantum algorithms. Defined by analogy to 
classical random walk, a quantum walk is a time-homogeneous quantum process on a graph. 
Both random and quantum walks can be defined either in continuous or discrete time. But 
whereas a continuous-time random walk can be obtained as the limit of a sequence of discrete- 
time random walks, the two types of quantum walk appear fundamentally different, owing to 
the need for extra degrees of freedom in the discrete-time case. 

In this article, I describe a precise correspondence between continuous- and discrete-time 
quantum walks on arbitrary graphs. Using this correspondence, I show that continuous-time 
quantum walk can be obtained as an appropriate limit of discrete-time quantum walks. The cor- 
respondence also leads to a new technique for simulating Hamiltonian dynamics, giving efficient 
simulations even in cases where the Hamiltonian is not sparse. The complexity of the simulation 
is linear in the total evolution time, an improvement over simulations based on high-order ap- 
proximations of the Lie product formula. As applications, I describe a continuous-time quantum 
walk algorithm for element distinctness and show how to optimally simulate continuous-time 
query algorithms of a certain form in the conventional quantum query model. Finally, I dis- 
cuss limitations of the method for simulating Hamiltonians with negative matrix elements, and 
present two problems that motivate attempting to circumvent these limitations. 

1 Introduction 

Recently, quantum walk has been established as one of the dominant algorithmic techniques for 
quantum computers. In the black-box setting, quantum walk provides exponential speedup over 
classical computation [13, 18]. Moreover, many quantum walk algorithms achieve polynomial 
speedup over classical computation for problems of practical interest. Following the development of 
quantum walk algorithms for search on graphs [16, 48] (subsequently improved in [8, 17, 52]), Am- 
bainis cemented the importance of quantum walk by giving an optimal algorithm for the element 
distinctness problem [5]. This approach was later generalized [36, 51] and applied to quantum 
algorithms for triangle finding [37], checking matrix multiplication [10], and testing group com- 
mutativity [35]. More recently, Farhi, Goldstone, and Gutmann used quantum walk to develop 
an optimal algorithm for evaluating balanced binary game trees [25], which led to optimal and 
near-optimal algorithms for evaluating broad classes of formulas [7, 43]. Indeed, since Grover's 
well-known search algorithm [30] can be interpreted as a quantum walk on the complete graph, 
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nearly all known quantum algorithms achieving polynomial speedup over classical computation can 
be viewed as quantum walk algorithms. 

Quantum walk is defined by analogy to classical random walk, and is motivated by the ubiquity 
of random walk in classical randomized computation. Random walks, or Markov chains, can either 
evolve continuously in time or by a discrete sequence of steps. The relationship between these two 
notions of random walk is straightforward, and indeed it is often possible to analyze both settings 
simultaneously (see for example [4]). 

A discrete-time Markov chain with states is specified by an x stochastic matrix M, 
a matrix with nonnegative entries whose columns sum to 1. One step of the walk transforms an 
initial probability distribution p £ M.^ into a new probability distribution p' = Mp. To approach a 
continuous-time Markov process, consider a lazy random walk in which we only make a transition 
with some small probability e > 0, replacing M by eM -|- (1 — e)I. Then we have 

p' - p = e{M - I)p. (1) 

In the limit e — > 0, letting one step of the discrete-time walk correspond to a time interval e, we 
obtain the dynamics 

^p(t) = (M-/Mt), (2) 

a continuous-time Markov process generated by M — I. In fact, any continuous-time Markov chain 
with A" sites can be written in the form (2) for some N x N stochastic matrix M, up to a rescaling 
of the time variable.^ 

Similarly, one can define two notions of quantum walk, the continuous-time quantum walk 
[15, 27] and the discrete-time quantum walk [2, 6, 53]. But in contrast to the classical case, these 
two models are apparently incomparable. 

The continuous-time quantum walk on an undirected graph is obtained by replacing the diffusion 
equation (2) with the Schrodinger equation 

i^^q{t)=Hq{t). (3) 

Here the Hamiltonian H is an N x N Hermitian matrix with Hji^. 7^ if and only if vertices j and 
k are connected, such as the adjacency matrix or Laplacian of the graph, and q{t) G is a vector 
of complex amplitudes, one for each vertex. The state space for the quantum walk is the same as 
for the corresponding classical random walk, and the dynamics are a direct quantum analog of (2). 

A step of a discrete-time quantum walk is a unitary operation that moves amplitude between 
adjacent vertices of a graph. Unlike in continuous time, there is no general definition of a discrete- 
time quantum walk that takes place directly on the vertices. In particular, there is no translation- 
invariant discrete-time unitary process on a d-dimensional lattice [38, 39], and in fact, only graphs 
with special properties can support local unitary dynamics at all, even without homogeneity restric- 
tions [47]. However, by enlarging the state space to include extra degrees of freedom, sometimes 
referred to as a quantum coin — or equivalently, by considering a walk on the directed edges of a 
graph — this limitation can be overcome [53]. 

^For example, given a graph with adjacency matrix A, maximum degree d, and a diagonal matrix of vertex 
degrees D (with Djj = deg(j)), the continuous-time random walk generated by the normalized Laplacian {A — D)/d 
(a negative semidefinite operator) can be viewed as the limit of the discrete-time random walk with transition matrix 
M = A/d+{I — D/d). The simple discrete-time random walk, in which a transition is made to a randomly selected 
neighbor at each step, has the transition matrix A/ — AD^^ , and corresponds to the continuous-time random walk 
generated by {A — D)D~^ . For a d-regular graph, D — dl, so these two choices are equivalent. 
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Despite these differences, examples of continuous- and discrete-time quantum walks on graphs 
show many qualitative similarities. For example, the walks on the line both spread linearly in time 
[6, 27], and the walks on the hypercube have the same instantaneous mixing time [41]. Furthermore, 
some quantum algorithms have been constructed that behave similarly in the two models (compare 
[16, 17] to [8, 48], and [25] to [7]). However, since the discrete-time walk takes place on a larger state 
space, it cannot simply reduce to the continuous-time walk as a limiting case. Indeed, no general 
correspondence between the dynamics of the two models has been given previously (although a 
particular correspondence has been noted for the infinite line and for the three-dimensional square 
lattice [50]). 

From a computational perspective, the two types of quantum walk each have their own advan- 
tages. As it does not require enlarging the state space, the continuous-time model is arguably more 
natural; it is simpler to define and usually easier to analyze. For example, while the exponential 
speedup by continuous-time quantum walk described in [13] is generally suspected to carry over 
to the discrete-time model, the dynamics are more involved, and to the best of my knowledge no 
rigorous analysis has been provided so far. 

On the other hand, the discrete-time model has the advantage that it is generally easy to 
implement using quantum circuits, whereas the main technique for implementing a continuous- 
time quantum walk requires the maximum degree of the graph to be small [3, 9, 12, 13]. Thus, for 
example, the element distinctness algorithm [5] seems difficult to reproduce using continuous-time 
quantum walk. 

In this article, I explore the relationship between continuous- and discrete-time quantum walk, 
showing how to carry the desirable features of each model to the other. The foundation of the results 
is a formal correspondence between the two models described in Section 2. This correspondence 
employs the quantization of discrete-time Markov chains proposed by Szegedy [51], which can also 
be used to give a discrete-time quantum walk corresponding to any Hermitian matrix, generalizing 
a construction of [7, 43]. 

Using this correspondence. Section 3 introduces a discrete-time quantum walk whose behavior 
approaches that of a related continuous-time quantum walk in a certain limit. In addition to 
providing a conceptual link between the two models, this limit offers a generic means of converting 
continuous-time quantum walk algorithms into discrete-time ones. For example, it shows that there 
is an efficient discrete-time quantum walk algorithm for the graph traversal problem of [13]. 

More significantly, I apply the correspondence to the simulation of Hamiltonian dynamics by 
quantum circuits, giving more efficient simulations than have been known so far. For a sparse 
Hamiltonian, it is well-known that the evolution according to (3) for time t can be simulated in 
^1+0(1) gtgpg [9^ 12]. By reduction to the problem of computing parity, reference [9] established 
what might be called a no fast- forwarding theorem: in general, a Hamiltonian cannot be simulated 
for time t using a number of steps that is sublinear in t. However, this left open the question 
of whether a truly linear-time simulation is possible. Moreover, even less has been known about 
the case where the Hamiltonian is not necessarily sparse, as introduced in Section 4. I show in 
Section 5 that by applying phase estimation to a discrete-time quantum walk, one can simulate 
Hamiltonian dynamics for time t using 0{t) operations, not only in the sparse case, but for even 
more general succinctly specified Hamiltonians. As an example of this method in action, I give 
an optimal continuous-time quantum walk algorithm for element distinctness (Section 6). I also 
describe an application to the simulation of continuous-time query algorithms using conventional 
quantum queries (Section 7). 

Unfortunately, although the new simulation method can be efficient well beyond the case of 
sparse Hamiltonians, it can sometimes be inefficient if the Hamiltonian is not only dense, but also 
includes matrix elements of both signs (or, more generally, if it has complex entries). I conclude in 
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Section 8 by posing some examples of Hamiltonians the method fails to address, but whose efficient 
simulation would lead to new quantum algorithms. 



2 A discrete-time quantum walk for any Hamiltonian 

We begin by constructing a discrete-time quantum walk corresponding to an arbitrary Hermitian 
matrix, i.e., to the Hamiltonian of any finite-dimensional quantum system. This construction is 
based on the work of Szegedy, who defined a discrete-time quantum walk corresponding to an 
arbitrary discrete-time classical Markov chain [51]. It was observed in [7] that Szegedy's framework 
can be used to connect continuous- and discrete-time quantum walk, assuming that the continuous- 
time quantum walk is generated by an entrywise positive, symmetric matrix. In [43] this was 
generalized to an arbitrary Hermitian matrix whose graph of nonzero entries is bipartite. Here, we 
describe a discrete-time quantum walk corresponding to a general N x N Hermitian matrix H. 

Fix an orthonormal basis {\j) : j = 1,...,A^} of C^, and let ahs{H) := Ylfk=i\^jk\ 
denote the elementwise absolute value of H in that basis. Let \d) := J2f=idj\3) ^ principal 
eigenvector of ahs(H) (i.e., an eigenvector with eigenvalue ||abs(-ff)||). if abs(ff) is irreducible, 
then by the Perron-Frobenius theorem, \d) is unique up to a phase, and that phase can be chosen 
so that the entries dj are strictly positive. We focus on the irreducible case without loss of generality, 
as if abs(-ff) is reducible, we can treat each of its irreducible components separately. Note that 
||abs(i?)|| > \\H\\, as can easily be proved using the triangle inequality. 

Define a set of N quantum states iV'i), • • • , \iPn) G as 




It is straightforward to check that these states are orthonormal. Notice that {j,k\ipj) 7^ if and 
only if j is adjacent to k in the graph of nonzero entries of H. 

The discrete-time quantum walk corresponding to H is defined as the unitary operator obtained 
by first refiecting about span{|'0j)} and then exchanging the two registers with the swap operation 
S (i.e., S\j, k) = \k,j)). Equivalently, two steps of the walk can be viewed as first reflecting about 
span{|'i/'j)}, and then refiecting about span{5'|V'j)}. Szegedy showed that the spectrum of a product 
of refiections depends in a simple way on the matrix of inner products between orthonormal bases 
for the two subspaces [51, Theorem 1].^ In the present case, we have 

(using the fact that H = H^), so we obtain a walk corresponding to H. 
More concretely, let 

T :=Y,\^|J,){J\ (6) 

be the isometry mapping li) G to lipj) G C^(g)C^. Then TT^ is the projector onto spanjlV'j)}, 
so the walk operator described above is S{2TT^ — 1). We have 



Note that this can also be viewed as a consequence of classic result of Jordan [42]. 
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Theorem 1. Suppose that Habsfg)!] I*^) ~ '^1'^)- Then the unitary operator 

u := iS(2rrt - 1) (7) 

has two normalized eigenvectors 

1 iti arccos A o 

Im±) := — r|A) (8) 

with eigenvalues fi± := j^g^^'^'''^^™''*. 

This result fohows directly from [51, Theorem 1], but the proof can be simplified since the walk 
is defined using the swap operation. We provide a proof here for the sake of completeness, along 
the same lines as [7, Theorem 6]. 

Proof. Consider the action of U on the vector T\\). Using T'^T = 1, we have 

UT\X) =iST\X), (9) 
and using T^ST = H/\\abs{H)\\, we have 

UST\X) = 2iXST\\) - iT\\). (10) 
Thus, the unnormalized state := T\\) + ifiST\X) has 

f/|^) = ^r|A) + i(l + 2iA^)5r|A), (11) 
and is an eigenvector of U with eigenvalue n provided 1 + 2iA^ = fi"^, i.e., 

= ±^1-A2+ iA = ieTiarccos(A) ^ ^g±iarcsm(A) ^^2) 

as claimed. The normalization follows from 

{fi\fi) = 1 + iXifi - IX*) + = 2(1 - A2), (13) 
which completes the proof. □ 

3 Continuous- time walk as a limit of discrete-time walks 

Using the correspondence described in the previous section, we can construct a discrete-time quan- 
tum walk whose behavior reproduces that of the continuous-time quantum walk generated by H in 
an appropriate limit. First we construct a discrete-time process that approximates the continuous- 
time one provided its eigenvalues are sufficiently small; then we construct a "lazy quantum walk" 
to obtain small eigenvalues. 

Let n denote the projector onto the subspace SY>&n{T\j) , ST\j) : j = 1, . . . ,N}, and consider 
the action of U restricted to this (invariant) subspace. If all eigenvalues A of i?/||abs(i?)|| are 
small, then arcsinA ~ A, meaning that the eigenvalues of H are approximately linearly related to 
the eigenphases of U. Furthermore, the eigenvectors of U are \ijl±) ~ (1 =F 15' + A5)T|A)/\/2, and 
we have 

inc/n p. V ^e^'^ ^ ^ + ^^ T| A) (A|rt ^ ^ + . (i4) 

A,± ^2 V2 
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This expression appears similar to the spectral expansion of the evolution according to i?/||abs(i?)|| 
for unit time, 



-iH/\\s.hs{H)\\ 



(15) 



except for (i) application of the isometry T, (ii) the presence of both positive and negative phases 
for each eigenvalue A, and (iii) rotations by approximately a square root of iS, namely (1 ibiS')/\/2- 
To obtain only the '— ' terms, we rotate the basis by (1 + iS)/^/2. Then we find 



rtizi:^(iC/)-l±i:^r«e-'^^ 



V2 



V2 



where the calculation has been carried out to 0(A). 

More precisely, we have the following approximation: 



Theorem 2. Let h := \\H\\/\\ahs{H)\\. Then 
Proof. By Theorem 1, we have 



iT_H'/||abs(H)|| 



</i2(1 + (|-1)/it) 



A,± 

Then a direct calculation gives 



arcsin A 



1 „iti arccos A c i „=Pi arccos A c 

'^r|A)(A|Tt-^"" ^ 



V2(l-A^) 



V2(l - A^) 



V2 

1 V-^e 



V2 



4 ^ 1 



±ir arcsin A 



A2 



■rt[(l + ie±' 



arccos A \ 



i + e 



ibi arccos A 



)S]T\X){X\ 



A,± T^[{1 — ie^^ + (i — gf'^^'^^'^°^^^S]T 



1 -,-„ibir arcsin A 

£ \ ^ +e 

4^ r^A2 



A,± 



-IT arcsin 



[(1 + ie±i'^'-=™«^) - (i + e^i^^ccosX^^-^ 
[(1 - ie^i arccos A) ^ _ e=Fia=^cc°'^^)A]|A)(A| 

'■^^1 - Vl - A2) + e-'-^'-^^'>^^(l + Vl- A2)]|A)(A|. 



(16) 



(17) 



(18) 



(19) 

(20) 
(21) 



Now we can use the inequality 1 — \/l — A^ < A^ to bound the norm of the first term by X'^/2. By 
the same inequality, |(1 + Vl^^) - 2|/2 < AV2. Thus we have 



1 — ^^jjy 1 + i'S' ji _ g-iTarcsin(_H'/||abs(//)||; 



V2 V2 

Using the inequalities |A — arcsinA| < (f — l)|Ap and |1 — e~'^| < \9\, we find 



-IT arcsin(i?/||abs(/f) 



and (17) follows by the triangle inequality. 



-irJ7/||abs(_H')|| 



(22) 

(23) 
□ 
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To obtain an arbitrarily good approximation of the dynamics, we require a systematic means 
of making h = \\H\\/\\ahs{H)\\ arbitrarily small. In other words, we must construct a lazy quantum 
walk, analogous to the lazy random walk that only takes a step with some small probability e as in 
(1). To do this, we enlarge the Hilbert space and modify the states from (4) to 

:= ^e\i;j) + VT^e\±j) (24) 

for some e £ (0, 1], where {|-Lj) : j = 1, . . . ,N} are orthonormal states satisfying 

= {i^j\S\±k) = {US\±k) = for J, = 1, . . . , AT. (25) 

Correspondingly, we modify the isometry T to := \ipj){j\. Using the fact that {^pj\H\■^pl.) = 
e{ij)j\H\il:k) , it can be shown that Theorems 1 and 2 still hold, but with H replaced by eH, so that 
A is replaced by eA and h is replaced by eh. Note that it is not necessary for the states iV'p to 
arise from some Hermitian operator as in (4). Perhaps the simplest choice is to enlarge the Hilbert 
space from x to x C^+\ and let = |j, N + 1). 

Overall, we obtain a procedure for simulating a continuous-time walk by a discrete-time one, 
as follows: 

1. Given an initial state |(^o) £ span{|j) : j = 1, . . . , A^}, apply the isometry and the unitary 
operation 

2. Apply r steps of the discrete-time quantum walk U := \S{2TfT} — 1). 

3. Project onto the basis of states { ^^^ T^\j) : j = 1, . . . , A^}. 

By Theorem 2 and the preceding discussion, the resulting outcomes are approximately distributed 
according to Pr(j) = |(j|e~''^^^/l'^^'^(^^l^|(/)o)P provided e^h? and e^h^T are small. To obtain a total 
evolution time t, we choose e = ||abs(/f)||t/T (subject to the constraint e < 1), where the accuracy 
can be improved by increasing the number of simulation steps r, hence decreasing e. 

More precisely, suppose our goal is to simulate the continuous-time quantum walk according to 
H for a total time t, obtaining a final state \(j)t) satisfying ||e~'^*|(/)o) — \(f>t)\\ < ^- Then it suffices 
to take 

T>max^^\\H\\t^J^^^^^^,\\a.hs{H)\\t^. (26) 

In other words, the complexity of the simulation is 0((||-?/||t)'^/^/\/^, ||abs(-ff)||t). 

Note that to implement the discrete-time quantum walk defined above, it must be possible 
to implement the isometry T (and its inverse). In particular, this requires computing ratios of 
nonzero components of the principal eigenvector \d), a global property of abs(if). While this 
may be difficult in general, it is tractable in many cases of interest. If the graph is regular, then 
the principal eigenvector is simply the uniform superposition; if it is non-regular but sufficiently 
structured, then it may be possible to compute \d) explicitly. For some applications it may be 
sufficient to precompute the principal eigenvector, as in [7, 43]. 

Alternatively, another option is to replace the states in (4) by 

;,'<:\ 




for some e G (0,1], where := ™axj ^^^^ \Hjk\, and where the states |_Lj) satisfy (25) with 

J2k=i 1 /-f^jfcli, playing the role of With this choice, no information about the principal 
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eigenvector of abs{H) is needed to implement the isometry T^' := X]j=i l^j^)Oli ^^'^ retain 
the necessary properties that {ip'j^\ip'^) = Sj^k and {ip'flSlip'i^) oc Hj^- However, since the quantity 
||abs(-ff)|| is replaced by the maximum absolute column sum norm ||-ff||i > ||abs(i?)||, the simulation 
may be less efficient (and in particular, still suffers from the sign problem discussed in Section 8). 

This simulation immediately shows that the exponential speedup by continuous-time quantum 
walk demonstrated in [13] carries over to the discrete-time model. (This is a case where the graph 
is slightly non-regular, but the principal eigenvector can be computed explicitly.) On the other 
hand, the speedup demonstrated in [18] apparently does not carry over, as ||abs(ff)|| » \\H\\ for 
the relevant Hamiltonian, and exponentially many steps of the discrete-time quantum walk would 
be required. We will return to this issue in Section 8. 

The estimate (26) may be overly pessimistic for some applications. To emulate the dynamics 
of the entire Hamiltonian, we choose e so that all eigenvalues are small. But for algorithms that 
effectively work in a low-energy subspace (e.g., [16, 17]), or that only depend on a small spectral 
gap (e.g., [7, 43]), it may be feasible to use little or no rescaling. 



4 Simulating non-sparse Hamiltonians 

We now turn to the problem of simulating Hamiltonian dynamics. In this section, we review known 
results about the simulation of sparse Hamiltonians, introduce the problem of simulating Hamil- 
tonians that are not necessarily sparse, and describe some preliminary results on the simulation of 
non-sparse Hamiltonians. 

Given a description of some Hermitian matrix H, Hamiltonian simulation is the problem of 
implementing the unitary operator e"^''^* by a quantum circuit for any desired value of t. Efficient 
simulations of sparse Hamiltonians are well-known. In the special case that H is local — i.e., when it 
is a sum of terms, each acting on a constant number of qubits — efficient simulation is straightforward 
[33]. More generally, a Hamiltonian can be simulated efficiently provided it is sparse and efficiently 
row- computable. We say a Hermitian operator H acting on C'^ is sparse in the basis {\j) : j = 
1, . . . , N} if for any j G {1, . . . , N}, there are at most poly(log N) values of k e {1, . . . , N} for 
which {j\H\k) is nonzero. We say it is efficiently row-computable if there is an efficient procedure 
for determining those values of k together with the corresponding matrix elements. 

The simulability of sparse Hamiltonians was first explicitly stated in [3]; it also follows from [13] 
together with classical results on local coloring of graphs [32]. The main idea is as follows. Suppose 
we color the edges of the graph of nonzero entries of H; then the subgraphs of any particular color 
consist of isolated edges, meaning that the evolution on any one of these subgraphs takes place 
in isolated two-dimensional subspaces, and is easily simulated. The subgraphs can be recombined 
using approximations to the Lie product formula, 

lim (e-i^*/"e-^^*/")" = e-*(^+^)*. (28) 
As the lowest-order approximation, supposing ||^||, \\B\\ < h, we have 



-iAt/n^~iBt/n\n _ ^„i(A+_B)i 



Oiihtf/n), (29) 



which shows that n = 0{{ht)'^ / 5) simulation steps suffice to achieve error at most 5. Similarly, at 
second order, 

AAt/2n^^-.Bt/n^~lAt/2nY _^-:{A+B)t = Q {{htf / n'') , (30) 



e 



so that n = 0{{ht)^^^ /\'^) simulation steps suffice. With approximations of increasingly high order, 
a simulation can be performed in nearly linear time [9, 12]. Ultimately, we have 



8 



Theorem 3. Suppose the graph of nonzero entries of H has N vertices and maximum degree d, and 
that H is efficiently row-computable, with \{j\H\k)\ < h for all j,k G {1,...,A^}. Then evolution 
according to H for time t with error at most 8 can he simulated in ht{ht/6)"^^^ •poly(d, log A^) steps. 

It is natural to ask under what conditions we can simulate a non-sparse Hamiltonian. Notice 
that if a Hamiltonian is not sparse, then it cannot be efficiently row-computable, simply because 
we cannot write down the nonzero entries of a row in polynomial time. However, we can still 
suppose that the Hamiltonian has a succinct description of some kind and ask whether an efficient 
simulation is possible. 

One way to simulate the dynamics of a non-sparse Hamiltonian is to use information about its 
spectrum. By the simple identity e~'^* = C/e~^^^^^*C/^, we can simulate H = UDU^ (with D 
diagonal) provided we can efficiently perform a unitary transformation U mapping the standard 
basis vector \j) to the jth eigenvector of H, and efficiently compute the jth eigenvalue of H, under 
some canonical ordering. For example, this approach can be used when H is the adjacency matrix of 
a complete graph, a complete bipartite graph, or a star graph (and even for some more complicated 
cases, e.g., the Winnie Li graph in odd dimensions [18]), all of which have high maximum degree. 
However, it is unclear how broadly this strategy can be applied. 

Here, we are interested in simulations based on the graph structure of the Hamiltonian in a 
fixed basis. To begin, suppose the Hamiltonian is the adjacency matrix of an A^-vertex graph G. 
We say that such a Hamiltonian is efficiently index- computable if, for any j £ {1,...,A^}, it is 
possible to efficiently compute deg(j) and to compute the kth neighbor of j (under some canonical 
ordering) for any index k £ {1, ■ ■ ■ ,deg(j)}. The discrete-time quantum walk on an unweighted 
graph G is straightforward to implement with such a description. In particular, given a black box 
for the degree and the j'th neighbors of any given vertex, a step of the discrete-time walk on G can 
be simulated using only four queries (to compute the degree, compute a neighbor, uncompute the 
neighbor, and uncompute the degree). More generally, we can consider graphs with edge weights 
under certain conditions mentioned below. 

As a preliminary observation, we can obtain efficient simulations of some non-sparse Hamilto- 
nians by generalizing the notion of edge coloring. Suppose we have a decomposition of the graph of 
nonzero entries of the Hamiltonian into a union of polynomially many subgraphs, each of which is 
a disjoint union of simulable subgraphs; then we can efficiently simulate the dynamics using the Lie 
product formula. Theorem 3 can be viewed as the special case where the simulable subgraphs are 
single edges. As a novel example of this technique, there is an efficient simulation of Hamiltonians 
whose graphs are trees: 

Theorem 4. Suppose the graph of nonzero entries of H is a rooted, efficiently index- computable 
tree, with the parent of any vertex having a known index. Furthermore, suppose that the weights 
on the edges from any given vertex are integrable, in the sense of [29] (which holds trivially for 
an unweighted graph), and that for any vertex we can efficiently compute the distance to the root. 
Then the evolution according to H for time t can be simulated in 0{{ht)^~^°^^^) steps, where h := 
max,- ySTOW- 

Proof. Consider a decomposition of the tree into two forests of stars. The first forest contains the 
complete star around the root and stars centered at all vertices an even distance from the root, 
including all child vertices (but not the parent vertex) in each star. The second forest contains the 
stars around vertices an odd distance from the root, again including all child vertices but not the 
parent vertex. The result is a decomposition H = Hi + H2, where the graphs of nonzero entries of 
Hi and H2 are both forests of stars. 
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A single star with center vertex and weight Wi on the edge (0, i) for i = 1, . . . ,k has exactly 
two nonzero eigenvalues, X± := ±-\/|u;ip + • • • + |tffcp, with corresponding normalized eigenvectors 

^(lo + ^E..*)). (31) 

To transform from the standard basis to the eigenbasis of the star, we can perform the operation 
|0) ^ (|0) + |l))/\/2, |1) ^ (|0) - |l))/\/2, |i) ^ \i) for i = 2,...,fc, followed by any operation 
satisfying |0) i-^ |0) and |1) ^ ^^iWili) / \+; the latter can be implemented by the techniques of 
[29]. 

By applying this simulation for all disjoint stars in one of the forests, we can simulate the 
dynamics of either Hi or H2 ■ Finally, using a high-order approximation of the Lie product formula, 
we can simulate the full Hamiltonian H with nearly linear overhead. □ 

It is not clear how to extend this strategy to general graphs. However, we will see next that the 
correspondence with discrete-time quantum walk gives a broadly applicable simulation method. 



5 Linear-time Hamiltonian simulation 



We now present the main result of the paper, a method of simulating Hamiltonian dynamics that 
exploits the connection between continuous- and discrete-time quantum walk. One such approach is 
to simply apply Theorem 2, which states that any Hamiltonian dynamics can be well-approximated 
by a corresponding discrete-time process. However, with that approach, the number of steps used 
to simulate evolution for time t scales as t^^^. Instead, we can obtain a linear-time simulation by 
combining Theorem 1 with phase estimation. By the no fast-forwarding theorem [9] , this scaling is 
optimal, even for sparse Hamiltonians. However, we do not require the Hamiltonian to be sparse. 
The simulation of an x Hamiltonian H proceeds as follows. Given an input state 

m=Y,i^x\X) (32) 

A 

in C^, where |A) denotes an eigenvector of i7/||abs(i7) || with eigenvalue A, apply the isometry T 
defined in (6) to create the state Tltp) G C^. This state may be written 

T|V') = J^VaTIA) (33) 

A 

E/ 1 \ ^ — i arccos A . , 1 \ arccos A . , \ / „ , \ 

A 

where we have used (8) to write each T|A) in terms of the corresponding eigenvectors \fi±) of the 
discrete-time quantum walk U corresponding to H. 

Our goal is to introduce a phase e~'^* for the A term of this superposition. To this end, 
perform coherent phase estimation on the discrete-time quantum walk U corresponding to H. 
Recall from Theorem 1 that the eigenvalues of U corresponding to the eigenvalue A of i?/||absi?|| 
are j^giiarcsmA Q£ gQurse, we are not directly interested in arcsin(A), but it implicitly determines A. 
Given an estimate A ~ A, we induce the phase e"^''**, uncompute A by performing phase estimation 
in reverse, and finally apply the inverse isometry Tt. Overall, we claim that this procedure achieves 
the following: 
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Theorem 5. A Hamiltonian H can be simulated for time t with fidelity at least 1 — S using 
0{\\ahs(H)\\t/\/^) steps of the corresponding discrete-time quantum walk (7). 

Proof. Let \9) denote an eigenstate of the discrete-time quantum walk with eigenvalue e'^. Let P 
denote the isometry that performs phase estimation on this walk, appending a register with an 
estimate of the phase, as follows: 



Then our simulation of the Hamiltonian evolution e~'^* is T'^ P'^ FfPT . 

Given an input state IV') as in (32), we compute the inner product between the ideal state 
g-iHtj^^ and the simulated state T"l'P"l'FtPT|^). Similarly to (34), we have 




(35) 




(37) 
(38) 




(39) 



and 





'^(^larcsin A 



-j^ Ae~^ arccos A 



(40) 



Therefore, using orthonormality of the eigenstates, we have 



{ilj\e'^^T^ P^ FtPT\ij) = \i^\\^{\\e'^^T^P^FtPT\\) 



(41) 



A 




(42) 



(43) 
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Thus the fidehty of the simulation is 

e'^^'T^P^FtPTm > min J]cos ((A - sin ,/>)^) '"'^1™^'' ^ '"-^l"-™^'' (44) 

> min >^cos ((sin0 — sin(/))t)|aA|/9p (45) 

6»e[0,27r)^ ^ 

>1- min ^ V] ((sine - sin(/))t)^|a<A|e|^ (46) 



where in the last step we have used the fact that |sin0 — s'm(j)\ < \9 — 

Now, to show that the fidelity is close to 1, we quantify the performance of phase estimation. To 
optimize the bound, we must choose the phase estimation procedure carefully. In standard phase 
estimation modulo M (using M — 1 calls to the unitary operation whose phase is being estimated), 
we begin with the uniform superposition Xlxio^ 1^) ™ register used to estimate the phase. 
However, other input states can give better estimates depending on the application. In particular, 
the initial state 



-Af-l 



- V sin ,V 48 



M . _ 

x=0 

minimizes the variance of the estimate [11, 20, 34], so it gives the best possible bound in (47). This 
initial state leads to the probability distribution 

I ,2 = cos^(Ai^)sin^(^) 

'"'+^1^' 2M(M+l)sin2(4 + ^)sin2(A__^)' 

where the estimated phase is + A = 27rj'/M for some integer j. Of course, only the value of 
j mod M is significant, and we can choose the range of angles so that A = Aq + 27rj'/M, where 
< Ao < 2tt/M and where the integer j satisfies - \M/2] +1 < j < [M/2\. Then for sufficiently 
large M, 

'"^+^1^'^ - 2M^^:m^(^ I . " )-m^(^ , ^ ^^^^ 

ZM sm + 2(M+1)) It ~ 2(M+1) ) 

1287r2 ^ ^ 

< 2 51 

-MW(l-^,^)2 

5127r2 

- 9M4A4' ^^^^ 
where the last step assumes that A > 27r/M. Since 271] /M < A < 27r(j + 1)/M, 

S-lft ^^2, |2^47r2 ^128(j + l)^ 

_ 47r2 256 / 157r^ + ^^ + 180C(3) \ 

~ M2 + 9M2 V 90 J ^ ' 

186 , , 
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Using this bound in (47), we obtain a simulation fidelity of at least 1 — 93t'^/M^. Thus we find that 
M = 0{t/\/S) steps suffice to obtain fidelity at least 1 — S. □ 



Of course, to carry out the simulation described in Theorem 5, we must be able to implement 
the discrete-time quantum walk. As discussed at the end of Section 3, this may be difficult in 
general due to the dependence of the states (4) on the principal eigenvector of ahs{H). However, 
it is straightforward to implement the walk for many cases of interest, such as for an unweighted 
regular graph. Indeed, the discrete-time quantum walk can be carried out efficiently provided 
only that the Hamiltonian is efficiently index-computable, and that the weights appearing in the 
states (4) are integrable in the sense of [29]. Alternatively, to avoid introducing a dependence on a 
principal eigenvector, one can use (27) at the expense of replacing ||abs(i?)|| by 

For Hamiltonians whose graphs are trees, the simulations of Theorems 4 and 5 are incomparable. 
On the one hand, the simulation of Theorem 4 runs in slightly superlinear time. On the other 
hand, the simulation of Theorem 5 scales with ||abs(i?)||, whereas Theorem 4 only scales with 
maxj \/Ylk which may be smaller. 

6 Element distinctness 

This section gives an application of Theorem 5 to quantum query complexity: a continuous-time 
quantum walk algorithm for the element distinctness problem. The intention is to formulate and 
analyze the algorithm entirely in terms of its Hamiltonian, but to ultimately quantify its complexity 
in terms of conventional quantum queries. The relationship of this algorithm to Hamiltonian-based 
models of query complexity is discussed at the end of Section 7. 

In the element distinctness problem, we are given a black-box function / : {1,... ,A^} — > S 
(for some finite set S) and are asked to determine whether there are two indices x,y £ {1, . . . , N} 
such that f{x) = f{y)- Ambainis found a discrete-time quantum walk algorithm that solves this 
problem with 0{N'^^^) queries [5], which is optimal [1]. Unlike quantum algorithms for search on 
low-degree graphs [8, 16, 17, 52], no continuous-time analog of the element distinctness algorithm 
has been known: the walk takes place on a high-degree Johnson graph, and sparse Hamiltonian 
techniques are insufficient to implement it. Since Ambainis's algorithm appeared, it has been an 
open question to find a continuous-time version (see for example [14, Section 5]). We now describe 
a continuous-time quantum walk that, when simulated using Theorem 5, gives an -query 
quantum algorithm for element distinctness. 

As in [5], the algorithm uses a walk on the Johnson graph J{N, M). The vertices of this graph 
are the (^) subsets of {1, . . . , N} of size M; edges connect subsets that differ in exactly one element. 
Let M := [A^^/s-j^ -j-j^g nearest integer to A^/^. 

To simplify the analysis, suppose there is a unique pair of indices x,y for which f{x) = f{y). 
By a classical reduction, this assumption is without loss of generality [5]. Let Aj denote the set of 
M-element subsets of {1, . . . , A^} that contain j elements from {x,y}. We use the convention that 
a set S written in a ket denotes the uniform superposition \S) := X^^g^ |s)/y^|S'| over the elements 
of S. Then in the basis {j^o); j^i); l^2)}5 the adjacency matrix of J{N, M) is 

/ -2M ^2M{N - M - 1) \ 

^/2M{N - M - 1) 2- A y^2{N - M){M - 1) + M{N - M). (56) 

V Y^2(A -M)(M- 1) 2(M-A) / 

We modify the graph to depend upon the black box as follows. For every subset in A2, add 
an extra vertex connected by an edge to the original subset. Denote the set of all such extra 
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vertices by i?2- Then the Hamiltonian for the algorithm is H 

{\Ao),\Ai),\A2),\B2)}, 



Hjj + He, where, in the basis 



u 



-2M 



c 



1 


^J2M{N - M - 1) 


2-iV ^2{N - M){M - I) 





Ar2/3 







^J2{N - M){M - I) 2{M-N) 







V 








0/ 


/O 


0\ 























1 








\0 


1 0^ 









(57) 



(58) 



For the initial state, take a uniform superposition over the vertices of the original Johnson 
graph, namely 



IV'(O)) := |AoU.4iU^2) 

= (1 - 0(iV-i/3))|Ao) + o(iv-i/^)|^i) + 0(iV-i/3)|^^^ 



N^ 
All 



(59) 
(60) 
(61) 



where we have used the choice M = [A^^/^] in the last line. Asymptotically, the starting state is 
essentially |^o)- 

To analyze the algorithm, we compute the spectrum of H. In principle, this could be done 
using techniques from [16, 17]. However, since the evolution takes place within a four-dimensional 
subspace, we can compute the relevant eigenvalues and eigenvectors in closed form. In particular, 
we find two eigenvalues \± = -'^^^^ N^^^ + 0(1) with eigenvectors 



|A+) 
|A_) 



+ o(^),o(^),o(^), yr^ + o(^) 

(0.6154,0,0,0.7882) 

(yr^+o(^),o(^),o(^),-v^+o(^) 

(0.7882,0,0,-0.6154), 



where 



0.3787. 



(62) 



(63) 



(64) 



17 + VT7 

Asymptotically, the algorithm is effectively confined to the two-dimensional subspace spanned by 
\Aq) and I -62)- The state rotates within this subspace at a rate determined by the inverse of the 
gap A+ — A- = 0{N~^^^). Therefore, the initial state (60) reaches a state with overlap 0(1) on 
1^2) in time 0{N^/^). 

To quantify the query complexity of this approach to element distinctness, we invoke Theorem 5. 
As in [5], suppose we store the M function values along with the subset at each vertex. Then 
preparmg (60) takes M = [iV^/^] 

queries. Furthermore, a step of the corresponding discrete-time 
quantum walk can be simulated using two queries: the walk operator is local on the Johnson graph, 
so we simply uncompute one function value and compute another. Given the function values for 
each subset, the extra edges for marked vertices can be included without any additional queries; 
indeed, by an observation in the proof of Theorem 8 of [7], they can be implemented by performing 
the walk on the graph with extra edges for every vertex of the Johnson graph, together with a 



14 



phase factor for the edges corresponding to marked vertices. Thus, the total number of queries 
used by the algorithm is 0(iV2/3 + ||abs(i?) HTV^/^). Since ||abs(ii')|| = 2N^I^ + 0{N^'^/^), we find 
an algorithm with running time (and, in particular, query complexity) 0(iV^/^). 

7 The continuous- time query model 

Continuous-time quantum walk has proven useful in motivating new algorithmic ideas. Ultimately, 
though, it is most straightforward to quantify the complexity of the resulting algorithms by the 
number of elementary gates needed to simulate them in the quantum circuit model, as in the 
example of Section 6. 

However, one can also formulate a notion of query complexity directly in a Hamiltonian-based 
model of computation. Such a model was first introduced by Farhi and Gutmann to describe a 
continuous-time analog [26] of Grover's search algorithm [30]; it was later studied in a broader 
context by Mochon [40] and applied to the quantum walk algorithm for evaluating balanced binary 
game trees [25]. 

In a general formulation of the continuous-time query model, an algorithm is described by a 
Hamiltonian of the form Ho[t) +Hq, where Hq is a fixed, time-independent Hamiltonian encoding 
a black-box input, and H£){t) is an arbitrary oracle-independent "driving Hamiltonian" (possibly 
time-dependent and with no a priori upper bound on its norm). The complexity is quantified simply 
by the total evolution time required to produce the result with bounded error. Equivalently, we 
can consider a model of fractional queries interspersed by non-query unitary operations, and take 
the limit in which the fractional queries can be arbitrarily close to the identity, charging only l/k 
of a full query to perform the feth root of a query. 

It is clear that the continuous-time query model is at least as powerful as the conventional query 
model. Very recently, it was shown that the continuous-time query model is in fact not significantly 
more powerful. In particular, any algorithm using continuous queries for time t can be simulated 
with 0(tlogt/loglogi) discrete queries [19]. 

Here we consider the case where the driving Hamiltonian Hoit) is restricted to be time- 
independent. We suppose that the query Hamiltonian Hq has the form used in [25]: namely, 
for a binary black-box input x G {0, 1}^, Hq acts on as 

HQ\i,b) = \i,b®Xi) (65) 

for any i € {1, . . . , A^} and b G {0, 1}. In other words, the query Hamiltonian describes a graph on 
2N vertices, with an edge between vertices {i, 0) and (i, 1) if Xj = 1, and no such edge if Xi = 0. 

Consider the case where Hu is time-independent. By simulating Hu + Hq with high-order 
approximations of the Lie product formula [9, 12], the evolution for time t can be approximated 
using (]]///)]]t)^''~''(^) queries to a unitary black box for the input x. Thus, a continuous-time 
quantum walk algorithm with ll-ff_Dll = 0(1) gives rise to a conventional quantum query algorithm 
using only queries. However, this simulation incurs more overhead than that of [19]. 

Instead, applying Theorem 5, and again using the observation from [7, Theorem 8] to imple- 
ment the discrete-time quantum walk using discrete queries (as in the simulation of the element 
distinctness algorithm in Section 6), we find 

Theorem 6. Consider a continuous-time query algorithm with the time-independent Hamiltonian 
Ho + Hq that runs in time t. Then the query complexity in the conventional discrete-time model 
isO{\\shs{HD)\\t). 
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In the case where Ho is time-independent and satisfies ||abs(i?£)) || = 0(1), this simulation 
outperforms [19]. However, it may be less efficient if ||abs(ff£))|| ^ 1, and is not even applicable to 
a general time-dependent H£,[t). Note, however, that almost all known continuous-time quantum 
algorithms have H£) time-independent (with the notable exception of adiabatic algorithms for 
search [22, 44], which can nevertheless be simulated efficiently in the quantum circuit model [45]) 
and satisfy ||abs(ff£)) || = 0(1). (It might be interesting to investigate the application of discrete- 
time quantum walk to simulating the dynamics of a time-dependent Hamiltonian.) 

Notice that the element distinctness algorithm from Section 6 does not naturally fit into the 
continuous-time query model. The simulation described in Section 6 uses 0{N'^^^) initial discrete 
queries, followed by 0(iV2/3^ 

queries to simulate an evolution for time only 0{N^/^). However, 
the techniques of [19] could not be used to simulate the latter evolution using only 0(iVV3 log jy) 
discrete queries: the initial queries and the queries used to simulate the evolution should balance 
to avoid violating the Q.{N'^/'^) lower bound for element distinctness [1]. Despite the superficial 
similarity between He and Hq, it is the term Hu, rather than H^ that depends on the black-box 
input; overall, Hu + Hq does not have the form of an oracle-independent Hamiltonian plus a query 
Hamiltonian of the form (65). 

8 A sign problem for Hamiltonian simulation 

Although the Hamiltonian simulations described in Sections 3~5 go considerably beyond previous 
techniques, they stop short of what might be possible. We conclude by considering two problems 
for which improved simulation methods would be valuable: approximating exponential sums and 
implementing quantum transforms over association schemes. Hopefully, these potential applications 
will motivate further work on the simulation of Hamiltonian dynamics. 

The essential problem with simulations based on the correspondence to discrete-time quantum 
walk has to do with the appearance of ||abs(i?)||, rather than \\H\\, in Theorem 5. The natural scal- 
ing parameter for Hamiltonian simulation would seem to be the basis- independent quantity \\H\\t 
rather than the basis-dependent quantity ||abs(-ff)||t; it seems reasonable to attempt a simulation 
in time poly(||i?||t). However, we do not currently know how to do this except in special cases. 

There are at least two potential approaches to circumventing this limitation. It might be 
possible to use decomposition techniques, such as the decomposition of trees into stars described 
in Section 4, in a more general context. We also might try to perform simulations in alternative 
bases that can be reached by efficient unitary transformations. 

8.1 Approximating Kloosterman sums 

An exponential sum over ¥q, the finite field with q elements, is an expression of the form 



where x multiplicative and additive characters of Fg, respectively, and f,g£ '^q[x] are 

polynomials. It is well known that, under fairly mild conditions. 



where the coefficient a depends on the degrees of / and g (see for example [46, Theorem 2.6]). 
However, computing the value of an exponential sum — or even approximating its magnitude as a 
fraction of with, say, constant precision — appears to be a difficult problem in general. 




(66) 




(67) 
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When / and g are both hnear in x, the sum (66) is known as a Gauss sum. Gauss sums have 
magnitude precisely ^ provided X) are nontrivial. No efficient classical algorithm for computing 
the phase of a general Gauss sum is known, but this phase can be efficiently approximated using 
a quantum computer [23]. It is an open question whether quantum computers can efficiently 
approximate other exponential sums. (Note that for the special case of small characteristic, it 
is possible to calculate more general exponential sums using the results of [31], as observed by 
Shparlinski; see [18].) 

Another type of exponential sum of particular interest is the Kloosterman sum, which is obtained 
by letting x be the quadratic character, f{x) = — c for some fixed c G Fg, and g{x) = x. It is easy 
to see that such a sum is real- valued. A classic result of Weil says that, provided ijj is nontrivial 
and c 7^ 0, the absolute value of the Kloosterman sum is at most 2y/g [54]. However, I am not 
aware of an efficient algorithm to compute even a single nontrivial bit of information about the 
Kloosterman sum, such as its sign or whether its magnitude is larger than y^. 

Kloosterman sums arise naturally in problems involving hidden nonlinear structures over finite 
fields [18]. In particular, the eigenvalues of a graph known as the Winnie Li graph (in even dimen- 
sions) are proportional to Kloosterman sums. An efficient quantum algorithm for approximating 
Kloosterman sums would provide new efficient quantum algorithms for certain hidden nonlinear 
structure problems. For example, this would give a way to implement a quantum walk that could 
be used to solve the so-called hidden fiat of centers problem. Conversely, an implementation of that 
quantum walk could be used to estimate the sums, using phase estimation. 

Let us consider a simple variant of the Winnie Li graph that exemplifies the relevant problem. 
Let G be the Cayley graph of the additive group of Fg with the generating set X := {x G Fg : 
xix^ ~ c) = +1} for some c G F^, where x denotes the quadratic character of Fg. Let p be the 

characteristic of Fg, and let tr : Fg — > Fp be the trace map, defined by tr(x) = x+x^+x^'^ + • • •+x'^/^ . 
Observe that 

5[xeX] = ]^{l + x{x^ - c) - 5[x^ = c]) , (68) 
where 6[P] is 1 if P is true and if P is false. Then for each /c G Fg, the Fourier vector 

^^p^^^'^x) (69) 



(where ojp := e^'^'/^) is an eigenvector of G with eigenvalue 

^ ^tr(fc..) = ^ i (1 + x{x^ - C) - 5[X^ = c]).;Mfex) (70) 
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\ [q 5[k = 0] + ^ - c) - cos ^ (71) 



(where the term involving ^/c does not appear if c is not a square in Fg). In particular, the 
eigenvalues of G are simply related to Kloosterman sums. 

Notice that fc = gives an eigenvalue \X\ = (g + l)/2 — 5[x{c) = +1] = ((7 ± l)/2 (the degree of 
G) corresponding to the uniform vector. Since we are only interested in the nontrivial Kloosterman 
sums, we can subtract off the projection of the adjacency matrix onto the uniform vector, defining a 
symmetric matrix H with {x\H\x') = 5[x — x' G X] — for x,x' G Fg. This Hamiltonian satisfies 
||i?|| < 2^^ (by Weil's Theorem), and a simulation of its dynamics for time t in poly(||i?||i, log g) 
steps would give an efficient quantum algorithm for approximating Kloosterman sums with constant 
precision. 
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Unfortunately, Theorem 5 is insufficient for this task. Whereas \\H\\ ~ 2^^, a simple calculation 
shows that ||abs(i7)|| = {q'^ — l)/2q = G(g), so ||abs(f/')||/||/i'|| is exponentially large (in logq). 
Similar considerations hold for the actual Winnie Li graph. 

8.2 Quantum transforms for association schemes 

An association scheme is a combinatorial object with useful algebraic properties (see [28] for an 
accessible introduction). We say that a set of matrices Aq, Ai, . . . , G {0,1}^^^ is a d-class 
association scheme on vertices provided (i) Aq = I, the N x N identity matrix; (ii) Yli=o ^« ~ 
the N X N matrix with every entry equal to 1; (iii) Af G {^Oj • • • i A^} for each i G {0, . . . ,d}; and 
(iv) AiAj = AjAi G spanj^O) • • • > ^d} for each i,j G {0, . . . , d}. An association scheme partitions 
the relationships between pairs of vertices into classes: we say that the relationship between vertex 
X and vertex y is of type i if (Ai)x,y = 1 (which implies that {Aj)x,y = for all j ^ i)- Let Ni 
denote the number of vertices of type i relative to any given vertex (or equivalently, the number of 
Is in any given row of Ai). 

The matrices Aq, Ai, . . . , A^ generate a {d + l)-dimensional algebra over C called the Bose- 
Mesner algebra of the scheme. This algebra is also generated by a set of d + 1 projection matrices 
Eq, El, . . . , Ed called its idempotents. These projections are orthonormal {EiEj = 6ijEi for all 
i,j G {0,... ,d}) and complete {Yli=o^'i ~ -^)' furthermore, the range of Ei is an eigenspace of 
Aj for every i,j G {0, . . . ,d}. Since they lie in the Bose-Mesner algebra, the idempotents can be 
expanded as iJj = Si=o lij^j' where the qij are referred to as the dual eigenvalues of the scheme. 

The unitary matrices in the Bose-Mesner algebra are precisely those matrices of the form 

d 

U = ^e"l'^Ei (72) 

1=0 

for some phases G M. Since they are highly structured, these unitary operators can be concisely 
specified even when we think of as exponentially large, and thus they represent a natural class of 
quantum transforms for possible use in quantum algorithms. Closely related to such a transform is 
the POVM with elements {Eq, Ei, . . . , Ed}- the ability to perform this measurement (coherently) 
can be used to implement any desired unitary transform in the Bose-Mesner algebra, and con- 
versely, implementation of any unitary transform in the Bose-Mesner algebra with well-separated 
eigenvalues can be used to measure {Eq, Ei, . . . , Ed}, by phase estimation. 

For a concrete application of association scheme transforms, consider the following problem. Fix 
a symmetric A^-vertex association scheme and an (unknown) vertex t of that scheme. Suppose we 
are given a black box function / : {1, . . . , A^} — > S with the promise that for all x, y G {1, . . . , A^}, 
f{x) = f{y) if and only if x and y are of the same class with respect to t (or in other words, if 
and only if {Ai)t^x = {Aj)t,y = 1 =^ i = j). The task is to learn t using as few queries to / as 
possible, ideally only poly(logA^). 

The shifted quadratic character problem is a particular instance of this problem in which the 
association scheme is the Paley scheme. It has d = 2 classes, meaning that it corresponds to 
a strongly regular graph, the Paley graph. In the Paley scheme, the vertices are elements of 
(where q = 1 mod 4), and {Ai)x,y = 1 if and only if x — y is a square in Fg. The sequence of 
values of the quadratic character x{t)-,x{t + 1); x(* + 2), . . . has been proposed as a pseudorandom 
generator [24] , and indeed no efficient classical algorithm is known that will learn t from the function 
f{^) = x{t + that hides t in the Paley scheme. On the other hand, van Dam, Hallgren, and Ip 
discovered a quantum algorithm that uses the quantum Fourier transform to solve this problem in 
time poly(logg) [21]. 
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Association scheme transforms provide a general approach to this problem. Suppose we prepare 
a uniform superposition over all vertices of the scheme, compute the hiding function /, and then 
discard its value. The result is a uniform superposition over points that are of type i relative to t, 

^ * X:(Ai)t.a: = l 



where type i occurs with probability Ni/N. Now suppose we apply the unitary operator (72), 
giving the state U\tjji), and measure the vertex. The probability that we obtain the vertex t is 



d 



N^ 



d 

E 

i=o 



(74) 



j,k=0 

Supposing that we know the value of i, we can choose the phases (pj to obtain a success probability 
Ni{J2j kjil)^/-^^- Since type i occurs with probability Ni/N, by always choosing the phases to 
optimize the probability of obtaining vertex t given that type i occurred (and pessimistically as- 
suming that we never obtain vertex t when another type occurs), we can succeed with probability 
at least Nf{^ - \qji\f' /N^. Thus, by always choosing the phases according to the value of i that 
maximizes this expression, we can achieve an overall success probability of at least 

For example, in the Paley scheme, a straightforward calculation shows that this approach succeeds 
with probability at least (^+ l)2(g - l)2/4g3 = \/\ + 0(1/^). 

The unitary operators (72) for the Paley scheme can be implemented efficiently because the 
corresponding idempotents are projections onto Fourier basis vectors. In particular, Eq = |0)(0|, 
El projects onto span{|A;) : x(^) = +1}; and E2 projects onto span{|A;) : x{k) = —1} (recall (69)). 
Thus, using the Fourier transform and the ability to compute quadratic characters (which can be 
done efficiently using Shor's algorithm for discrete logarithms [49]), we can efficiently carry out the 
above strategy to solve the shifted quadratic character problem. 

However, this approach is not very different from the one in [21], which employs similar tools. 
Instead, it would be appealing to have a purely combinatorial means of implementing (72), which 
could be applied even for association schemes without an underlying group structure. 

One way to implement (72) would be to coherently measure each of the idempotents in turn, per- 
forming a phase shift conditional on the measurement outcome and then undoing the measurement. 
In principle, these measurements could be performed by applying phase estimation to a simulation 
of Hamiltonian dynamics with the Hamiltonian given by the idempotent. Unfortunately, in many 
cases of interest, this approach encounters the same sign problem seen in the previous section. For 
example, whereas ||ii'i|| = 1, one can show that ||abs(-Ei)|| = (y^ + l)(g — l)/2g = 0(y^)- Since 
||abs(Si)||/||i?i|| is exponentially large in logg, we again find that Theorem 5 does not give an 
efficient implementation. 
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